There are extensive investigations on adversarial attacks for natural image classifications. In [1]}, FGSM was proposed to generate adversarial examples based on the CNN gradients. A DeepFool method was proposed in [2]} to compute minimal perturbations based on classifier's linearization. In [3]}, an iterative algorithm was proposed to generate perturbations and showed the existence of a universal (image-agnostic) adversarial perturbations. In [4]}, a Transformation Network (ATN) was trained to generate adversarial examples without gradient involvement. The adversarial training and provable defense were proposed in [5]} to achieve both attack robustness and high accuracy. The capsule based reconstructive attack was proposed in [6]} to cause both misclassifications and reconstructive errors. Besides image classification, several attack methods were proposed for semantic segmentation, object detection and object tracking [7]}. In [8]}, [9]}, the classification based attacks were shown transferable to attack deep image segmentation results. The universal perturbations were demonstrated existing in [3]}. Moreover, a Dense Adversary Generation (DAG) method was proposed [11]} for both semantic segmentation and object detection attacks. The general idea of natural image attacks was to iteratively generate perturbations based on the CNN gradients to maximize the network predictions of adversarial examples and the ground truth labels. This idea was also reflected in [12]} to show the medical attacks. Different from existing methods, we propose a stabilized regularization term to ensure the consistent generation of adversarial perturbations, which are effective for different types of medical image datasets.
